Threats tagged 'pysec-2026-4352'

vLLM versions from 0.10.2 up to but not including 0.25.0 contain a vulnerability where unauthenticated attackers can cause uncontrolled memory consumption by submitting specially crafted decompression-bomb images. This leads to out-of-memory (OOM) conditions that kill worker processes and cause denial of service. The issue arises because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None, disabling limits on image decompression size. A fix is available in version 0.25.0.